topic Re: Summary Index in Reporting

Summary Index

VijaySrrie — Thu, 18 Mar 2021 06:46:58 GMT

Hi,

I have a scheduled search where summary indexing is enabled

I also have a summary index created.

The output of the scheduled search is not send to summary index.

summar index = "test_summary"

Scheduled search name - test_summary_report

summary indexing is enabled

Cron schedule is set to run every minute.

What would be the issue?

Re: Summary Index

manjunathmeti — Thu, 18 Mar 2021 07:42:17 GMT

hi @VijaySrrie,
1. Check the time period for the scheduled search test_summary_report and see if the search produces any results in that time period. You can check the event count for the scheduled search on the Activity >> Jobs page.

2. If you are getting results in the time period then use the collect command to push the search results to the summary index.

saved_search_query | collect index=test_summary sourcetype=test

If this reply helps you, an upvote/like would be appreciated.

Re: Summary Index

VijaySrrie — Thu, 18 Mar 2021 14:42:42 GMT

@manjunathmeti when I opened the scheduled search I could see the results

Scheduled search Query - | inputlookup lookup.csv

I tried the below query

saved_search_query | collect index=test_summary sourcetype=test

| inputlookup lookup.csv | collect index=test_summary (This is not working) --> When I searched the index=test_summary (Time range: All time) - I was not getting any results

Re: Summary Index

manjunathmeti — Thu, 18 Mar 2021 17:02:59 GMT

Check if the user has access to index test_summary.

Re: Summary Index

VijaySrrie — Fri, 19 Mar 2021 01:08:47 GMT

@manjunathmeti I am the user who created the Index, I have admin access

Re: Summary Index

VijaySrrie — Fri, 19 Mar 2021 04:28:52 GMT

@manjunathmeti you can see the query has run and we are getting the results, and the results from the query is sent to the index, but when i search the index=test_summary, no results are seen.

Re: Summary Index

manjunathmeti — Fri, 19 Mar 2021 06:52:51 GMT

Try summarizing in another index:

| inputlookup noc | summaryindex index=main sourcetype=test